Zero-day report: September 2026
CISA added 43 exploited vulnerabilities to its catalog in September 2026, 12 more than August (31). 25 were zero-days, listed within a week of going public. The most-hit vendor was Cisco, with 4.
By technology
Most-hit vendors
Every flaw added in September 2026
- Cisco · Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
- Apple · Multiple ProductsApple Multiple Products Out-of-Bounds Write Vulnerability
- Citrix · NetScalerCitrix NetScaler Improper Input Validation Vulnerability
- Citrix · NetScalerCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Microsoft · SharePointMicrosoft SharePoint Code Injection Vulnerability
- MikroTik · RouterOSMikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
- WordPress · CoreWordPress Core Remote File Inclusion Vulnerability
- WSO2 · Multiple ProductsWSO2 Multiple Products Path Traversal Vulnerability
- Adobe · Commerce and Magento Adobe Commerce and Magento Incorrect Authorization Vulnerability
- Check Point · Multiple ProductsCheck Point Multiple Products Improper Certificate Validation Vulnerability
- Check Point · Multiple ProductsCheck Point Multiple Products Path Traversal Vulnerability
- Arista · VeloCloud OrchestratorArista VeloCloud Orchestrator Improper Input Validation Vulnerability
- F5 · BIG-IP APMF5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
- Zyxel · GS1900 Series SwitchesZyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- Linux · KernelLinux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- Linux · KernelLinux Kernel Race Condition Vulnerability
- Linux · KernelLinux Kernel Out-of-Bounds Write Vulnerability
- Google · PixelGoogle Pixel Improper Authorization Vulnerability
- Cisco · Identity Services EngineCisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
- Acronis · BackupAcronis Backup Incorrect Default Permissions Vulnerability
- Cisco · Secure Email GatewayCisco Secure Email Gateway SQL Injection Vulnerability
- JFrog · ArtifactoryJFrog Artifactory Incorrect Authorization Vulnerability
- JFrog · ArtifactoryJFrog Artifactory Improper Authentication Vulnerability
- ConnectWise · ScreenConnectConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
- GitLab · Community Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- MikroTik · RouterOSMikroTik RouterOS Missing Authentication for Critical Function Vulnerability
- MikroTik · RouterOSMikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
- Fortinet · Multiple ProductsFortinet Multiple Products Heap-based Buffer Overflow Vulnerability
- Citrix · NetScalerCitrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Cisco · Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall ManagementCisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Google · Chromium V8Google Chromium V8 Out of Bounds Write Vulnerability
- Adobe · Commerce and MagentoAdobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
- Microsoft · WindowsMicrosoft Windows Link Following Vulnerability
- Microsoft · WindowsMicrosoft Windows Heap-Based Buffer Overflow Vulnerability
- N-able · N-centralN-able N-central Static Code Injection Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- Kludex · StarletteKludex Starlette HTTP Request/Response Smuggling Vulnerability
- Kestra · Kestra OSSKestra OSS OS Command Injection Vulnerability
- BerriAI · LiteLLMBerriAI LiteLLM Improper Authentication Vulnerability
- JFrog · ArtifactoryJFrog Artifactory Improper Authentication Vulnerability
- SonicWall · SMA1000 AppliancesSonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- SonicWall · SMA1000 AppliancesSonicWall SMA1000 Appliances OS Command Injection Vulnerability
- Sangoma · SwitchvoxSangoma Switchvox SQL Injection Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.